-- The MIT License (MIT)
--
-- Copyright (C) 2026 Scott Duensing
--
-- Permission is hereby granted, free of charge, to any person obtaining a copy
-- of this software and associated documentation files (the "Software"), to
-- deal in the Software without restriction, including without limitation the
-- rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
-- sell copies of the Software, and to permit persons to whom the Software is
-- furnished to do so, subject to the following conditions:
--
-- The above copyright notice and this permission notice shall be included in
-- all copies or substantial portions of the Software.
--
-- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-- IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-- FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
-- AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-- LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
-- FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
-- IN THE SOFTWARE.

-- account.lua -- an account on the service under test, made as a person makes one:  registered, the
-- link in its mail followed (read from the mail queue in the database), then signed in.  Loaded by
-- the suites, and run by serve.sh for the DOS tests' account:
--
--     calog test/account.lua -- <base URL> <database> <email> <password>

local account = {}

local JSON = { ["Content-Type"] = "application/json" }


local function post(base, path, body)
    local r = httpRequest({ method = "POST", url = base .. path, headers = JSON, body = jsonStringify(body) })
    local ok, value = pcall(jsonParse, r.body or "")
    return r.status, (ok and type(value) == "table") and value or {}
end


-- Make the account:  its session's token and the text of the mail it was sent (nil and why when
-- something refused).  The rate limits are cleared first, since a test makes many.
function account.make(base, database, email, password)
    local h = dbOpen("sqlite", database)
    dbExec(h, "DELETE FROM rateLimit")
    dbClose(h)
    post(base, "/v1/account/register", { email = email, password = password })

    h = dbOpen("sqlite", database)
    local rows = dbQuery(h, "SELECT body FROM mailQueue WHERE recipient = ? ORDER BY id DESC LIMIT 1", email)
    dbClose(h)
    if not rows[1] then
        return nil, "no mail was queued for " .. email
    end
    local mail = rows[1].body
    post(base, "/v1/account/verify", { token = mail:match("verify%?token=(%x+)") })
    local status, session = post(base, "/v1/account/login", { email = email, password = password })
    if status ~= 200 or not session.token then
        return nil, "signing in answered " .. tostring(status)
    end
    return session.token, mail
end


-- Run by itself:  make the account the arguments name
local args = calogArgs()
if not ACCOUNT_LOADED and #args == 4 and args[1]:match("^http://") then
    local token, why = account.make(args[1], args[2], args[3], args[4])
    if not token then
        calogPrint("account.lua: " .. tostring(why))
        calogExit(1)
    end
    calogExit(0)
end

return account